The ZCA VM must have Managed Identities enabled and permissions must be set to Contributor, or
greater, at the Subscription level.
Can you explain why this is required
Aaron S from Zerto here. The Contributor level is the minimum level at which Zerto can still access the required resources that we need access in order to perform successfully.